Stolen UpdraftCentral keys used to backdoor WordPress sites
Original title: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
Signed commands installed backdoor plugins from October 18 to 19; no plugin update stops it, so sites must delete UpdraftCentral keys.
An attacker with valid UpdraftCentral dashboard keys is installing backdoor plugins on connected WordPress sites. Patchstack says the campaign ran from 15:32 on October 18 through 09:23 on October 19 and was still active on October 19, with no vendor fix. Commands are encrypted and signed with genuine keys, so every UpdraftPlus release, including 1.26.11 and 2.26.11, treats them as legitimate. The backdoor creates an Editor that also receives manage_options and install_plugins, logs in by cookie, and survives plugin removal.
Unconfirmed: Researchers infer the private keys leaked from UpdraftCentral Cloud; TeamUpdraft had not explained the incident when the post went live.
- UpdraftPlus has over four million active installations; the client ships in free and premium copies.
- Nethemba first analyzed the campaign; requests came from the attacker's server, not vendor infrastructure.
- A coding error caused HTTP 500 responses; repairing that plugin would activate the backdoor.
- Sites below 1.26.5 and 2.26.5 also remain exposed to June's CVE-2026-10795 command-forgery flaw.
Impact: Remote plugin install and persistent site admin via a hidden Editor
| Product | Affected |
|---|---|
| TeamUpdraft UpdraftPlus | All versions, free and premium, with an active UpdraftCentral key |
| TeamUpdraft UpdraftCentral | Sites enrolled with an active dashboard key |
- 1.Delete UpdraftCentral keys on connected sites.
- 2.Remove the backdoor plugin; do not repair its fatal error.
- 3.Update copies below 1.26.5 or 2.26.5, which still face forged-command attempts.
- Vendors
- TeamUpdraft
- Organizations
- PatchstackNethemba
From the original article
9 min read at patchstack.com
An attacker holding valid UpdraftCentral dashboard keys is installing backdoor plugins on connected WordPress sites. The campaign ran continuously through an 18-hour window on 18-19 October. Patchstack blocks UpdraftCentral remote commands and has deployed mitigation rules covering it.
By Edouard · patchstack.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.